A maliciously crafted file processed by CoreGraphics can lead to code execution on affected Apple devices. Apple’s October 26 security update fixes the out-of-bounds write in iOS 18.7.11 and iPadOS 18.7.11. Check older iPhones and eligible iPads that still run the 18-series branch.
Apple says it is aware of a report that CVE-2026-86950 may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on iOS versions before iOS 27. CISA’s enrichment in the Apple-assigned CVE record marks the flaw as known exploited, with a September 29 entry date.
Crafted files and memory writes
CoreGraphics processes graphical content in files. An out-of-bounds write means a program writes outside the memory area reserved for that data. Apple says, “Processing a maliciously crafted file may lead to arbitrary code execution.” Apple fixed the write with improved bounds checking. Patch affected devices across the inventory.
The CVE record identifies fixes on several branches: iOS and iPadOS 18.7.11 and 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1. For a mixed fleet of older handsets, newer tablets and Macs, match each installed operating-system branch to its own fixed version; 18.7.11 is the release for devices on the older branch.
Camera access and audio data
The same Apple release repairs two other problems. In Audio, an app could leak sensitive user information because of a logic issue; improved checks address CVE-2026-65339. Apple’s CVE record for that issue also lists fixes for other Apple operating systems.
In CoreMedia, a malicious app could access the camera without user permission. Apple changed access restrictions for CVE-2026-86990; its CVE record lists separate fixes on newer iOS and iPadOS branches and other platforms. Investigate suspicious app camera access and crafted-file processing as separate incident leads.
Confirm updates on eligible devices
Start with managed-device inventory. Apple explicitly lists iPhone XS, XS Max and XR, plus eligible iPads, for the 18.7.11 release. Compare each device model and installed OS branch against Apple’s affected-device list, then schedule iOS or iPadOS 18.7.11 for devices that remain on the 18-series branch. Check that the management console reports the installed version after the device reconnects; a queued update is still work waiting to happen.
For devices on other supported branches, compare their installed versions with the fixes named in the relevant Apple-assigned CVE records. For a credible targeted-attack lead, preserve available device and management history and investigate earlier activity through incident response. The installed-version check verifies patch state.
Query the eligible-device inventory again after the rollout. Each device expected to receive the 18-series patch should report 18.7.11; investigate devices still reporting an older build or missing a recent check-in.